Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
505 views

Is the Block Bad Queries Plugin Still Relevant?

The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
1
vote
1answer
8k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
1answer
165 views

Using password protection to load different page elements?

I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
-1
votes
5answers
3k views

Is it a bad idea to CHMOD 777 all the files on your site?

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked? How should I undo this, which files should be chmod to what number?
-1
votes
2answers
2k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
0
votes
1answer
135 views

User generated content and security

I'm gonna create a new site. I want to make the site as user generate able content site. Basically this is my site's function. Users signup in my wordpress site, Submit content from wp-admin panel, ...
2
votes
1answer
1k views

What is the relationship between cURL, WordPress and cacert.pem?

I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error: httprequest_failed: SSL certificate problem, verify ...
0
votes
2answers
1k views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
2
votes
1answer
392 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
4
votes
1answer
294 views

What is the most secure way to store post meta data in WP?

Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood. What is the most secure way ...
-1
votes
1answer
150 views

Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?

I was thinking of adding the following lines of code to my functions.php file: /** * Change the default list of allowed html tags */ add_action('init', 'edittag', 10); function edittag() { ...
0
votes
1answer
221 views

Is there a way to hide WordPress behind a web visible directory?

Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
2
votes
3answers
8k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS #...
6
votes
1answer
741 views

Which KSES should be used and when?

The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes." On the other hand, wp_kses_data is passed data that's "expected to not be ...
1
vote
1answer
65 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
5
votes
1answer
1k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
78
votes
12answers
11k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe src="http://evilsite.com/go/1">&...
1
vote
1answer
93 views

Why was my blog post inserted lot's of ad links by others?

I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it? A screenshot : I post some codes on my blog, the ad links are ...
0
votes
1answer
120 views

Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?

If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to 1)Post a large number of posts ...
4
votes
1answer
128 views

Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies"). Wordpress filters <img> tags by default (except ...
8
votes
3answers
593 views

Will there be security updates for 3.1 once 3.2 is released?

I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
3
votes
4answers
1k views

ensure user can only be logged in on one computer at a time?

how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
1
vote
1answer
291 views

Detect session/cookie variable in wordpress to prevent access to documents

<?php @session_start(); If (!array_key_exists(‘authed’, $_SESSION)) { include ‘not_authed.inc’; exit(); } // go about your business. ?> and i'm trying to add that to this: <?...
5
votes
2answers
4k views

Can upload doc and pdf but not ppt - not permitted for security reasons

"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting. ...
6
votes
3answers
1k views

WordPress Ajax Data Security

I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
4
votes
4answers
830 views

What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end

I've been building wordpress sites for a few years now and have noticed a few things that bother me. 1. It's fairly slow (awful blanket statement, I apologize) My initial desire to create a ...
19
votes
13answers
2k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
14
votes
3answers
467 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
3
votes
2answers
2k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
1
vote
4answers
6k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
1answer
1k views

Securing wp-config leads to sensitive information leak on wp-settings

I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder. http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php I did this, and it works ...
1
vote
1answer
698 views

Is disabling test_form in wp_handle_upload a security concern?

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback. ...
3
votes
2answers
1k views

Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?

I have 2 WordPress MultiSite installs (on different accounts, but under the same HostGator reseller a/c) and both seem to have been compromised. I say "compromised" because the user_logins have been ...
2
votes
1answer
218 views

Is it possible to post with Word 2007 via XML-RPC and limit categories by user?

I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
1
vote
1answer
523 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...
-2
votes
3answers
196 views

Should WordPress Add Options to Enhance Security or Leave it to plugin developers?

Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"... ...
0
votes
3answers
399 views

WP Insert Post If user refreshes override new post

WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
3
votes
2answers
1k views

Correct Approach for Validating Custom Field Input

I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
0
votes
1answer
323 views

security concerns if using html data-* attribute for l10n?

I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
9
votes
5answers
12k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
0
votes
1answer
170 views

Secure Server after configuration

Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands. My website is working into it, properly. Now I just want to know how to secure it? ...
4
votes
2answers
854 views

How Attackers write script into my php files?

I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files. Let's assume i have holes in my plugin scripts, but how can they write into php files? ...
2
votes
2answers
846 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
-1
votes
1answer
305 views

How to protect wp-admin from third party access?

How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
3
votes
5answers
485 views

WordPress and Security

Are there some simple ways to beef up the security on a WordPress site?
1
vote
1answer
182 views

Using HTACCESS for Secret Access

I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
20
votes
4answers
34k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
3
votes
2answers
642 views

Setting WP Admin passwords to expire

I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
6
votes
2answers
578 views

How can I lock down an old wordpress install I don't intend to update?

I am starting a new wordpress blog, and no longer updating an old one. The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its posts....
1
vote
2answers
148 views

What may be causing failure of auto-install features in Wordpress (v3.0.3)?

What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...